| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner hat zugeschlagenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.07.2012, 17:59
| #1 |
| |  GVU Trojaner hat zugeschlagen Hallo Leute! Bei mir hat gestern abend der GVU Trojaner meinen Rechner gesperrt! Die Maske war mit einem Webcam bild in der reechten oberen Ecke versehen. Nur komisch weil meine Webcam garnicht eingesteckt ist!  Sonst stand halt das üblich drin. Zahle 100 € etc.! Linke Ecke oben mein Internet Provider, IP und das alles. Hab es leider mit fotografiert.  Konnte dann weder Task-Manager öffnen noch per Windows taste drücken irendeine Reaktion erzugen! Strg+Alt+entf hat mich dann ( Habe Windows 7 64 bit ) auf die ebene gebracht wo man einen Neustart machen kann. Dieses habe ich dann auch getan. Nach dem er wieder vollständig hochgefahren ist war erstmal alles ok! Ca. 5-10 sek. später hat sich der Desktop gesperrt. Also ich habe weder meine Icons gesehen noch Taskleiste. Es kam aber keine GVU Maske wie zuvor. Also wieder Strg+Alt+entf habe Neustart gedrückt und gleich abbrechen. Habe ihn dann heute im Agesicherten Modus mit installierten Netzwerktreiben gestartet und schreibe jetzt diese Mail. Seit dem läuft er normal. Habe mit dann Malewarebytes Anti-Maleware aus dem Netz gezogen und durchlaufen lassen. Bericht ist angehängt. Auch habe ich OTL laufen lassen (Quickscan wie beschrieben) Bericht hängt ebenfalls hinten an. Defogger ist auch erledigt. So was nun? Würde mich über Hilfe echt freuen. Danke an alles schon mal im Vorraus.  Beste Grüße Christian Malewarebytes Bericht: Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.21.09 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 KillerBeas :: KILLERBEAS-PC [Administrator] Schutz: Deaktiviert 21.07.2012 17:47:43 mbam-log-2012-07-21 (18-49-32).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 574996 Laufzeit: 59 Minute(n), 52 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\KillerBeas\AppData\Local\Temp\rool0_pk.exe (Spyware.Zbot.DG) -> Keine Aktion durchgeführt. F:\Program Files (x86)\Steam\SteamApps\common\Mass Effect 2\Binaries\Mass Effect 2 v1.2 + 9 Trainer.exe (HackTool.GamesCheat) -> Keine Aktion durchgeführt. C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt. (Ende) <-----------------------------------------------------> OTL Bericht: OTL logfile created on: 21.07.2012 18:34:21 - Run 2 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\KillerBeas\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,99 Gb Total Physical Memory | 5,26 Gb Available Physical Memory | 65,84% Memory free 15,98 Gb Paging File | 13,45 Gb Available in Paging File | 84,18% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 195,31 Gb Total Space | 101,08 Gb Free Space | 51,75% Space Free | Partition Type: NTFS Drive D: | 244,04 Gb Total Space | 47,21 Gb Free Space | 19,34% Space Free | Partition Type: NTFS Drive E: | 128,47 Gb Total Space | 126,41 Gb Free Space | 98,40% Space Free | Partition Type: NTFS Drive F: | 195,31 Gb Total Space | 45,79 Gb Free Space | 23,45% Space Free | Partition Type: NTFS Drive G: | 205,54 Gb Total Space | 119,49 Gb Free Space | 58,13% Space Free | Partition Type: NTFS Drive L: | 931,28 Gb Total Space | 653,05 Gb Free Space | 70,12% Space Free | Partition Type: FAT32 Computer Name: KILLERBEAS-PC | User Name: KillerBeas | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.20 17:54:30 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- g:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe PRC - [2012.03.28 17:08:24 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\KillerBeas\Desktop\OTL.exe ========== Modules (No Company Name) ========== MOD - [2012.07.20 17:54:29 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012.06.11 19:19:14 | 000,239,616 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012.07.20 17:54:30 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.06.27 12:29:24 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- G:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012.06.04 11:50:20 | 001,766,464 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- G:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe -- (GDFwSvc) SRV - [2012.06.01 05:05:18 | 002,011,056 | ---- | M] (G Data Software AG) [Auto | Stopped] -- G:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe -- (AVKWCtl) SRV - [2012.05.25 14:19:24 | 001,540,120 | ---- | M] (G Data Software AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy) SRV - [2012.04.24 21:02:39 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan) SRV - [2012.03.15 19:36:32 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.02.17 18:54:30 | 000,076,888 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Stopped] -- G:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe -- (AVKService) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.05.20 15:26:28 | 000,199,536 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Stopped] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.06.11 20:59:38 | 010,248,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.06.11 18:26:14 | 000,367,616 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.05.11 22:55:13 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD) DRV:64bit: - [2012.05.09 15:49:33 | 000,059,768 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt) DRV:64bit: - [2012.05.09 00:52:42 | 000,064,376 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre) DRV:64bit: - [2012.05.09 00:52:24 | 000,122,744 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt) DRV:64bit: - [2012.05.09 00:52:24 | 000,065,912 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd) DRV:64bit: - [2012.05.09 00:52:24 | 000,054,136 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.01.22 19:55:37 | 000,088,480 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2012.01.22 19:55:37 | 000,046,400 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2011.07.24 00:55:43 | 000,513,080 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2011.07.23 19:03:19 | 000,031,448 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GdNetMon64.sys -- (GdNetMon) DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.05.20 15:26:28 | 002,060,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VX1000.sys -- (VX1000) DRV:64bit: - [2010.03.18 20:52:18 | 000,295,000 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\haP17v2k.sys -- (hap17v2k) DRV:64bit: - [2010.03.18 20:52:10 | 000,259,672 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\haP16v2k.sys -- (hap16v2k) DRV:64bit: - [2010.03.18 20:52:02 | 001,360,984 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha10kx2k.sys -- (ha10kx2k) DRV:64bit: - [2010.03.18 20:51:50 | 000,147,544 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia) DRV:64bit: - [2010.03.18 20:51:34 | 000,290,392 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k) DRV:64bit: - [2010.03.18 20:51:26 | 000,016,984 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k) DRV:64bit: - [2010.03.18 20:51:18 | 000,221,272 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv) DRV:64bit: - [2010.03.18 20:50:52 | 000,866,264 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM) DRV:64bit: - [2010.03.18 20:50:42 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k) DRV:64bit: - [2010.03.18 20:40:10 | 000,141,912 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTERFXFX.sys -- (CTERFXFX.SYS) DRV:64bit: - [2010.03.18 20:40:10 | 000,141,912 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTERFXFX.sys -- (CTERFXFX) DRV:64bit: - [2010.03.18 20:40:02 | 000,681,048 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTSBLFX.sys -- (CTSBLFX.SYS) DRV:64bit: - [2010.03.18 20:40:02 | 000,681,048 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTSBLFX.sys -- (CTSBLFX) DRV:64bit: - [2010.03.18 20:39:54 | 000,706,648 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTAUDFX.sys -- (CTAUDFX.SYS) DRV:64bit: - [2010.03.18 20:39:54 | 000,706,648 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTAUDFX.sys -- (CTAUDFX) DRV:64bit: - [2010.03.18 20:39:44 | 000,158,808 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\COMMONFX.sys -- (COMMONFX.SYS) DRV:64bit: - [2010.03.18 20:39:44 | 000,158,808 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\COMMONFX.sys -- (COMMONFX) DRV:64bit: - [2009.09.16 08:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.03.18 18:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2007.04.10 04:17:22 | 000,123,688 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CTHWIUT.DLL -- (CTHWIUT.DLL) DRV:64bit: - [2007.04.10 04:17:00 | 000,252,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CT20XUT.DLL -- (CT20XUT.DLL) DRV:64bit: - [2007.04.10 04:16:20 | 001,571,112 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CTEXFIFX.DLL -- (CTEXFIFX.DLL) DRV:64bit: - [2007.04.10 04:15:44 | 000,363,304 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CTEDSPSY.DLL -- (CTEDSPSY.DLL) DRV:64bit: - [2007.04.10 04:15:10 | 000,190,248 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CTEDSPIO.DLL -- (CTEDSPIO.DLL) DRV:64bit: - [2007.04.10 04:13:38 | 000,321,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CTEDSPFX.DLL -- (CTEDSPFX.DLL) DRV:64bit: - [2007.04.10 04:13:08 | 000,219,432 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\CTEAPSFX.DLL -- (CTEAPSFX.DLL) DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 E3 D6 DC C8 66 CD 01 [binary data] IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=" FF - prefs.js..network.proxy.type: 4 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: G:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.28 01:32:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 17:54:30 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.20 11:10:32 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: g:\Program Files (x86)\Mozilla Thunderbird\components [2012.05.20 11:10:32 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: g:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.05.20 11:10:32 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: G:\Program Files (x86)\Mozilla Thunderbird\components [2012.05.20 11:10:32 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: G:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.05.20 11:10:32 | 000,000,000 | ---D | M] [2011.07.24 01:10:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Extensions [2011.07.24 01:10:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.07.16 22:47:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions [2012.06.28 19:27:52 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012.04.20 21:21:37 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.07.16 22:47:37 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} [2012.06.28 19:27:55 | 000,000,853 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\searchplugins\11-suche.xml [2012.06.28 19:27:55 | 000,002,209 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\searchplugins\englische-ergebnisse.xml [2012.06.28 19:27:55 | 000,010,506 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\searchplugins\gmx-suche.xml [2012.06.28 19:27:55 | 000,002,368 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\searchplugins\lastminute.xml [2012.06.28 19:27:55 | 000,005,489 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\searchplugins\webde-suche.xml [2012.05.03 16:15:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.05.09 00:52:21 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\mozilla firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad} [2011.08.16 13:44:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} () (No name found) -- C:\USERS\KILLERBEAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GSD14P7Q.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI () (No name found) -- C:\USERS\KILLERBEAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GSD14P7Q.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI [2012.07.20 17:54:30 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.04.21 23:10:57 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.02.05 11:33:26 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.05 11:33:26 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.02.05 11:33:26 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.02.05 11:33:26 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.05 11:33:26 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.05 11:33:26 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AsioThk32Reg] C:\Windows\SysWow64\ctasio.dll (Creative Technology Ltd) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [CTHelper] C:\Windows\SysWow64\CtHelper.exe (Creative Technology Ltd) O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [G Data AntiVirus Tray Application] G:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) O4 - HKLM..\Run: [GDFirewallTray] G:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] G:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] G:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] g:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\KillerBeas\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - G:\Program Files (x86)\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Free YouTube Download - C:\Users\KillerBeas\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - G:\Program Files (x86)\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0) O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2) O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C7CBCCDA-0F5A-44C4-9555-DFEB6B909716}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\cdo - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{21e143c0-b57f-11e0-9669-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{21e143c0-b57f-11e0-9669-806e6f6e6963}\Shell\AutoRun\command - "" = I:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.07.21 17:46:44 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.21 17:46:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.21 00:59:07 | 000,000,000 | ---D | C] -- C:\Users\KillerBeas\AppData\Roaming\Malwarebytes [2012.07.21 00:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.20 18:45:24 | 000,000,000 | ---D | C] -- C:\Users\KillerBeas\Documents\SimCity 4 [2012.07.20 18:37:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxis [2012.07.05 21:20:14 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.07.05 21:19:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2012.07.05 21:19:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2012.06.29 23:18:46 | 000,000,000 | ---D | C] -- C:\Users\KillerBeas\Documents\My Cheat Tables [2012.06.26 20:24:09 | 000,000,000 | ---D | C] -- C:\Users\KillerBeas\Documents\NavyField [2012.06.26 20:20:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eFusion [2012.06.24 10:34:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.06.24 10:33:59 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.06.24 10:33:59 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.21 17:47:19 | 000,000,795 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.21 17:44:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.21 17:44:18 | 2140,446,719 | -HS- | M] () -- C:\hiberfil.sys [2012.07.21 01:30:00 | 000,034,240 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000007-00000000-00000001-00001102-00000004-20021102}.rfx [2012.07.21 01:30:00 | 000,034,240 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000007-00000000-00000001-00001102-00000004-20021102}.rfx [2012.07.21 01:30:00 | 000,030,528 | ---- | M] () -- C:\Windows\SysNative\BMXCtrlState-{00000007-00000000-00000001-00001102-00000004-20021102}.rfx [2012.07.21 01:30:00 | 000,030,528 | ---- | M] () -- C:\Windows\SysNative\BMXBkpCtrlState-{00000007-00000000-00000001-00001102-00000004-20021102}.rfx [2012.07.21 01:30:00 | 000,011,564 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000007-00000000-00000001-00001102-00000004-20021102}.rfx [2012.07.21 01:04:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.21 01:00:34 | 000,014,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.21 01:00:34 | 000,014,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.21 00:57:45 | 000,724,506 | ---- | M] () -- C:\Windows\SysWow64\sig.bin [2012.07.21 00:57:45 | 000,041,931 | ---- | M] () -- C:\Windows\SysWow64\nmp.map [2012.07.21 00:56:38 | 004,931,577 | ---- | M] () -- C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.CDF [2012.07.21 00:56:38 | 004,931,577 | ---- | M] () -- C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.BAK [2012.07.21 00:56:11 | 004,503,728 | ---- | M] () -- C:\ProgramData\kp_0loor.pad [2012.07.21 00:53:26 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.21 00:41:51 | 000,001,891 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.20 19:03:14 | 000,001,428 | ---- | M] () -- C:\Users\KillerBeas\Desktop\SimCity 4.lnk [2012.07.20 18:34:53 | 000,000,529 | ---- | M] () -- C:\Windows\eReg.dat [2012.07.18 20:59:37 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.18 20:59:37 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.18 20:59:37 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.18 20:59:37 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.18 20:59:37 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.11 22:58:46 | 000,290,352 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.03 23:01:59 | 000,005,889 | ---- | M] () -- C:\Users\KillerBeas\Desktop\Anschreiben_20120703230117.pdf [2012.07.03 23:01:08 | 000,022,484 | ---- | M] () -- C:\Users\KillerBeas\Desktop\Übertragungsprotokoll_ESt2011_Schmidt_Christian.pdf [2012.07.03 22:51:20 | 000,010,639 | ---- | M] () -- C:\Users\KillerBeas\chschmid_elster_2048.pfx [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.01 10:37:22 | 000,001,292 | ---- | M] () -- C:\Users\KillerBeas\Desktop\RelicCOH - Verknüpfung.lnk [2012.06.30 11:00:08 | 000,000,690 | ---- | M] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk [2012.06.26 20:20:55 | 000,000,753 | ---- | M] () -- C:\Users\Public\Desktop\NavyFIELD Europe (DE).lnk [2012.06.24 10:34:15 | 000,001,577 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.21 17:46:45 | 000,000,795 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.21 00:41:50 | 004,503,728 | ---- | C] () -- C:\ProgramData\kp_0loor.pad [2012.07.21 00:41:50 | 000,001,891 | ---- | C] () -- C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.20 18:43:05 | 000,001,428 | ---- | C] () -- C:\Users\KillerBeas\Desktop\SimCity 4.lnk [2012.07.20 18:34:53 | 000,000,529 | ---- | C] () -- C:\Windows\eReg.dat [2012.07.03 23:01:59 | 000,005,889 | ---- | C] () -- C:\Users\KillerBeas\Desktop\Anschreiben_20120703230117.pdf [2012.07.03 23:01:08 | 000,022,484 | ---- | C] () -- C:\Users\KillerBeas\Desktop\Übertragungsprotokoll_ESt2011_Schmidt_Christian.pdf [2012.07.03 22:51:07 | 000,010,639 | ---- | C] () -- C:\Users\KillerBeas\chschmid_elster_2048.pfx [2012.07.01 10:37:22 | 000,001,292 | ---- | C] () -- C:\Users\KillerBeas\Desktop\RelicCOH - Verknüpfung.lnk [2012.06.29 23:18:43 | 008,745,984 | ---- | C] () -- C:\Users\KillerBeas\Desktop\gghz-cohv2.602trn.EXE [2012.06.26 20:20:55 | 000,000,753 | ---- | C] () -- C:\Users\Public\Desktop\NavyFIELD Europe (DE).lnk [2012.06.24 10:34:15 | 000,001,577 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.04.24 21:01:30 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2012.04.24 21:01:30 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2012.04.08 00:42:29 | 000,000,073 | ---- | C] () -- C:\Users\KillerBeas\AppData\Local\X-Plane_drm.prf [2012.04.08 00:10:03 | 000,000,080 | ---- | C] () -- C:\Users\KillerBeas\AppData\Local\X-Plane Installer.prf [2012.03.29 10:36:19 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll [2012.03.29 10:36:19 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll [2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011.11.25 18:37:53 | 000,001,466 | ---- | C] () -- C:\Users\KillerBeas\AppData\Local\RecConfig.xml [2011.11.12 00:07:34 | 000,282,864 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.11.10 15:35:03 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.08.23 16:39:02 | 000,182,272 | ---- | C] () -- C:\Windows\patchw32.dll [2011.08.22 17:19:25 | 000,007,601 | ---- | C] () -- C:\Users\KillerBeas\AppData\Local\Resmon.ResmonCfg [2011.08.05 19:26:42 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2011.07.24 16:06:28 | 000,724,506 | ---- | C] () -- C:\Windows\SysWow64\sig.bin [2011.07.23 18:06:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin ========== LOP Check ========== [2012.04.22 14:50:43 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\.minecraft [2012.07.20 18:16:44 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Azureus [2012.07.20 18:33:47 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\DAEMON Tools Lite [2012.04.20 21:31:37 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\DVDVideoSoft [2012.04.20 21:21:36 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\DVDVideoSoftIEHelpers [2012.05.30 23:02:48 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\elsterformular [2012.04.20 21:14:49 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Engelmann Media [2012.04.20 21:15:37 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\HDX4 GmbH [2012.01.18 21:01:19 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Kalypso Media [2011.11.30 19:51:02 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Mumble [2011.11.26 22:17:29 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\No23 [2011.11.10 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Origin [2012.02.05 17:53:24 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Raptr [2011.08.18 00:30:13 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Simfy [2012.06.12 00:08:29 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\temp [2012.02.15 20:03:58 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\The Creative Assembly [2011.07.24 01:10:14 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Thunderbird [2011.07.26 01:15:23 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Tropico 3 [2012.01.18 21:02:43 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Tropico 4 [2012.03.05 00:35:48 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\TS3Client [2012.03.04 20:32:24 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\ts3overlay [2011.08.04 00:06:58 | 000,000,000 | ---D | M] -- C:\Users\KillerBeas\AppData\Roaming\Tunngle [2012.05.24 10:28:04 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:CB0AACC9 < End of report > |
|
21.07.2012, 18:17
| #2 |
| /// Helfer-Team  | GVU Trojaner hat zugeschlagen Trenne die Internet-Verbindung. Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
SRV - [2012.02.17 18:54:30 | 000,076,888 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.de/"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q="
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{21e143c0-b57f-11e0-9669-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{21e143c0-b57f-11e0-9669-806e6f6e6963}\Shell\AutoRun\command - "" = I:\autorun.exe
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:CB0AACC9
[2012.06.28 19:27:52 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2012.07.21 01:04:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.21 00:57:45 | 000,724,506 | ---- | M] () -- C:\Windows\SysWow64\sig.bin
[2012.07.21 00:57:45 | 000,041,931 | ---- | M] () -- C:\Windows\SysWow64\nmp.map
[2012.07.21 00:56:38 | 004,931,577 | ---- | M] () -- C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.CDF
[2012.07.21 00:56:38 | 004,931,577 | ---- | M] () -- C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.BAK
[2012.07.21 00:56:11 | 004,503,728 | ---- | M] () -- C:\ProgramData\kp_0loor.pad
[2012.07.21 00:53:26 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.21 00:41:51 | 000,001,891 | ---- | M] () -- C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.21 00:41:50 | 004,503,728 | ---- | C] () -- C:\ProgramData\kp_0loor.pad
[2012.07.21 00:41:50 | 000,001,891 | ---- | C] () -- C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
22.07.2012, 10:42
| #3 |
| | GVU Trojaner hat zugeschlagen Hey!
__________________Danke für die schnell Antwort!  Habe das gerade ausgeführt! Meine Frage jetzt ist damit alles bereinigt oder muss ich noch was machen! Kann ja sein das der Trojaner noch irgendwo rumhängt! Oder gibt es ein paar gute Programme die du mir empfehlen kannst damit ich noch sicherer durch netz surfern kann. Habe als Firewall und Virenprogramm GData Internet Security 2013 mir gekauft! Benutze das auch schon seit knapp zwei Jahren! Danke für deine Tipps im Vorraus!Grüße Christian |
|
22.07.2012, 10:47
| #4 | |
| /// Helfer-Team | GVU Trojaner hat zugeschlagen Wo ist das Log? Zitat:
|
|
22.07.2012, 12:41
| #5 |
| | GVU Trojaner hat zugeschlagen Ups!  Sorry dachte das war es! Ok hier ist es!<----------------------------------------------> All processes killed ========== OTL ========== Service PnkBstrA stopped successfully! Service PnkBstrA deleted successfully! C:\Windows\SysWOW64\PnkBstrA.exe moved successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully. C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll moved successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found. File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully! Prefs.js: true removed from browser.search.useDBForOrder Prefs.js: "hxxp://www.google.de/" removed from browser.startup.homepage Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=" removed from keyword.URL Prefs.js: 4 removed from network.proxy.type 64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully. File C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully. File C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found. File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found. File C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate deleted successfully. C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21e143c0-b57f-11e0-9669-806e6f6e6963}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21e143c0-b57f-11e0-9669-806e6f6e6963}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21e143c0-b57f-11e0-9669-806e6f6e6963}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21e143c0-b57f-11e0-9669-806e6f6e6963}\ not found. File I:\autorun.exe not found. ADS C:\ProgramData\TEMP:CB0AACC9 deleted successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\Plugins folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\modules folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully. C:\Users\KillerBeas\AppData\Roaming\mozilla\Firefox\Profiles\gsd14p7q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully. C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully. C:\Windows\SysWOW64\sig.bin moved successfully. C:\Windows\SysWOW64\nmp.map moved successfully. File move failed. C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.CDF scheduled to be moved on reboot. C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.BAK moved successfully. C:\ProgramData\kp_0loor.pad moved successfully. C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully. C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully. File C:\ProgramData\kp_0loor.pad not found. File C:\Users\KillerBeas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found. ========== FILES ========== < ipconfig /flushdns /c > Windows-IP-Konfiguration Der DNS-Aufl”sungscache wurde geleert. C:\Users\KillerBeas\Desktop\cmd.bat deleted successfully. C:\Users\KillerBeas\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 56475 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: KillerBeas ->Temp folder emptied: 625890056 bytes ->Temporary Internet Files folder emptied: 253622810 bytes ->Java cache emptied: 3706660 bytes ->FireFox cache emptied: 1034502428 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 70558 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 762736 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1666110 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes RecycleBin emptied: 3533978929 bytes Total Files Cleaned = 5.202,00 mb [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: KillerBeas ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.39.2 log created on 07222012_011118 Files\Folders moved on Reboot... C:\Windows\{00000007-00000000-00000001-00001102-00000004-20021102}.CDF moved successfully. File\Folder C:\Users\KillerBeas\AppData\Local\Temp\2011-09-12-1181181579_04-RG.PDF not found! C:\Users\KillerBeas\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot... |
|
22.07.2012, 18:17
| #6 |
| /// Helfer-Team | GVU Trojaner hat zugeschlagen Sehr gut!  Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ --> GVU Trojaner hat zugeschlagen |
|
22.07.2012, 21:04
| #7 |
| | GVU Trojaner hat zugeschlagen Bis jetzt läuft er ohne Probleme! OK hier das Log von Maleware: Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.22.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 KillerBeas :: KILLERBEAS-PC [Administrator] Schutz: Aktiviert 22.07.2012 20:15:17 mbam-log-2012-07-22 (20-15-17).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 578605 Laufzeit: 1 Stunde(n), 43 Minute(n), 48 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) <--------------------------------------------------------------> Und das Log von Adw: # AdwCleaner v1.703 - Logfile created 07/22/2012 at 22:01:40 # Updated 20/07/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : KillerBeas - KILLERBEAS-PC # Running from : C:\Users\KillerBeas\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Users\KillerBeas\AppData\Local\Conduit Folder Found : C:\Users\KillerBeas\AppData\LocalLow\Conduit Folder Found : C:\Users\KillerBeas\AppData\LocalLow\DVDVideoSoftTB Folder Found : C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\ConduitCommon Folder Found : C:\Program Files (x86)\Conduit Folder Found : C:\Program Files (x86)\DVDVideoSoftTB ***** [Registry] ***** [*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2269050[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2504091 Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Softonic Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine Key Found : HKLM\SOFTWARE\Conduit Key Found : HKLM\SOFTWARE\DT Soft Key Found : HKLM\SOFTWARE\DVDVideoSoftTB Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar [x64] Key Found : HKCU\Software\AppDataLow\Software\Conduit [x64] Key Found : HKCU\Software\AppDataLow\Software\SmartBar [x64] Key Found : HKCU\Software\AppDataLow\Toolbar [x64] Key Found : HKCU\Software\Conduit [x64] Key Found : HKCU\Software\Softonic [x64] Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v14.0.1 (de) Profile name : default File : C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\prefs.js Found : user_pref("CT2269050..clientLogIsEnabled", false); Found : user_pref("CT2269050..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Found : user_pref("CT2269050..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Found : user_pref("CT2269050.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Found : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Found : user_pref("CT2269050.BrowserCompStateIsOpen_129681780741097243", true); Found : user_pref("CT2269050.BrowserCompStateIsOpen_129853623028165512", true); Found : user_pref("CT2269050.CTID", "CT2269050"); Found : user_pref("CT2269050.CurrentServerDate", "22-7-2012"); Found : user_pref("CT2269050.DSInstall", false); Found : user_pref("CT2269050.DialogsAlignMode", "LTR"); Found : user_pref("CT2269050.DialogsGetterLastCheckTime", "Thu Jul 19 2012 22:45:57 GMT+0200"); Found : user_pref("CT2269050.DownloadReferralCookieData", ""); Found : user_pref("CT2269050.EMailNotifierPollDate", "Fri Apr 20 2012 21:22:22 GMT+0200"); Found : user_pref("CT2269050.FirstServerDate", "20-4-2012"); Found : user_pref("CT2269050.FirstTime", true); Found : user_pref("CT2269050.FirstTimeFF3", true); Found : user_pref("CT2269050.FixPageNotFoundErrors", true); Found : user_pref("CT2269050.GroupingServerCheckInterval", 1440); Found : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Found : user_pref("CT2269050.HPInstall", false); Found : user_pref("CT2269050.HasUserGlobalKeys", true); Found : user_pref("CT2269050.Initialize", true); Found : user_pref("CT2269050.InitializeCommonPrefs", true); Found : user_pref("CT2269050.InstallationAndCookieDataSentCount", 3); Found : user_pref("CT2269050.InstallationType", "UnknownIntegration"); Found : user_pref("CT2269050.InstalledDate", "Fri Apr 20 2012 21:22:22 GMT+0200"); Found : user_pref("CT2269050.InvalidateCache", false); Found : user_pref("CT2269050.IsGrouping", false); Found : user_pref("CT2269050.IsInitSetupIni", true); Found : user_pref("CT2269050.IsMulticommunity", false); Found : user_pref("CT2269050.IsOpenThankYouPage", false); Found : user_pref("CT2269050.IsOpenUninstallPage", false); Found : user_pref("CT2269050.LanguagePackLastCheckTime", "Sun Jul 22 2012 01:10:27 GMT+0200"); Found : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440); Found : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Found : user_pref("CT2269050.LastLogin_3.12.0.8", "Thu Apr 26 2012 00:01:22 GMT+0200"); Found : user_pref("CT2269050.LastLogin_3.12.2.3", "Wed May 30 2012 11:18:32 GMT+0200"); Found : user_pref("CT2269050.LastLogin_3.13.0.6", "Thu Jun 28 2012 16:15:06 GMT+0200"); Found : user_pref("CT2269050.LastLogin_3.14.1.0", "Sun Jul 22 2012 01:03:58 GMT+0200"); Found : user_pref("CT2269050.LatestVersion", "3.13.0.6"); Found : user_pref("CT2269050.Locale", "en"); Found : user_pref("CT2269050.MCDetectTooltipHeight", "83"); Found : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Found : user_pref("CT2269050.MCDetectTooltipWidth", "295"); Found : user_pref("CT2269050.MyStuffEnabledAtInstallation", true); Found : user_pref("CT2269050.OriginalFirstVersion", "3.12.0.8"); Found : user_pref("CT2269050.RadioIsPodcast", false); Found : user_pref("CT2269050.RadioLastCheckTime", "Fri Apr 20 2012 21:22:23 GMT+0200"); Found : user_pref("CT2269050.RadioLastUpdateIPServer", "3"); Found : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000"); Found : user_pref("CT2269050.RadioMediaID", "12473383"); Found : user_pref("CT2269050.RadioMediaType", "Media Player"); Found : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383"); Found : user_pref("CT2269050.RadioShrinkedFromSetup", false); Found : user_pref("CT2269050.RadioStationName", "Hotmix%20108"); Found : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082"); Found : user_pref("CT2269050.SearchCaption", "DVDVideoSoftTB Customized Web Search"); Found : user_pref("CT2269050.SearchFromAddressBarIsInit", true); Found : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...] Found : user_pref("CT2269050.SearchInNewTabEnabled", true); Found : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440); Found : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Sun Jul 22 2012 01:10:11 GMT+0200"); Found : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Found : user_pref("CT2269050.SendProtectorDataViaLogin", true); Found : user_pref("CT2269050.ServiceMapLastCheckTime", "Sun Jul 22 2012 01:10:16 GMT+0200"); Found : user_pref("CT2269050.SettingsLastCheckTime", "Sun Jul 22 2012 01:03:02 GMT+0200"); Found : user_pref("CT2269050.SettingsLastUpdate", "1341904940"); Found : user_pref("CT2269050.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13"); Found : user_pref("CT2269050.ThirdPartyComponentsInterval", 504); Found : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Fri Apr 20 2012 21:22:18 GMT+0200"); Found : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1312887586"); Found : user_pref("CT2269050.ToolbarShrinkedFromSetup", false); Found : user_pref("CT2269050.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2269050"); Found : user_pref("CT2269050.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Found : user_pref("CT2269050.UserID", "UN14047572394191617"); Found : user_pref("CT2269050.WeatherNetwork", ""); Found : user_pref("CT2269050.WeatherPollDate", "Fri Apr 20 2012 21:22:25 GMT+0200"); Found : user_pref("CT2269050.WeatherUnit", "C"); Found : user_pref("CT2269050.alertChannelId", "666138"); Found : user_pref("CT2269050.autoDisableScopes", -1); Found : user_pref("CT2269050.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...] Found : user_pref("CT2269050.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...] Found : user_pref("CT2269050.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...] Found : user_pref("CT2269050.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...] Found : user_pref("CT2269050.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...] Found : user_pref("CT2269050.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...] Found : user_pref("CT2269050.backendstorage./9b+7e06cg5el8:", "6E6D6E6E6A706C6F7378"); Found : user_pref("CT2269050.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A7473747470767275797E242F4B4947[...] Found : user_pref("CT2269050.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...] Found : user_pref("CT2269050.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...] Found : user_pref("CT2269050.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...] Found : user_pref("CT2269050.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...] Found : user_pref("CT2269050.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...] Found : user_pref("CT2269050.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...] Found : user_pref("CT2269050.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...] Found : user_pref("CT2269050.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...] Found : user_pref("CT2269050.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...] Found : user_pref("CT2269050.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...] Found : user_pref("CT2269050.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...] Found : user_pref("CT2269050.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...] Found : user_pref("CT2269050.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...] Found : user_pref("CT2269050.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...] Found : user_pref("CT2269050.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...] Found : user_pref("CT2269050.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...] Found : user_pref("CT2269050.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...] Found : user_pref("CT2269050.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...] Found : user_pref("CT2269050.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...] Found : user_pref("CT2269050.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...] Found : user_pref("CT2269050.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...] Found : user_pref("CT2269050.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...] Found : user_pref("CT2269050.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...] Found : user_pref("CT2269050.backendstorage./9b-0?3g>d", "6D70716D6D3F41457A45434773207D797777257D5220202A23[...] Found : user_pref("CT2269050.backendstorage./9b-0?3g@6:5;", ""); Found : user_pref("CT2269050.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F297B7E7D21202F26313E424[...] Found : user_pref("CT2269050.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576"); Found : user_pref("CT2269050.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484776213F3E484F4E4D464[...] Found : user_pref("CT2269050.backendstorage./9b5ba==9cjag", "6E3C6B706A6E71407A78794573794A4C4D7E7C4F22"); Found : user_pref("CT2269050.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6E6E6A706C6F7370727479"); Found : user_pref("CT2269050.backendstorage./9b9643g3/9e", "6A"); Found : user_pref("CT2269050.backendstorage./9b<:222h64<", "393F352F3E"); Found : user_pref("CT2269050.backendstorage./9b=+03eh8h8j?:", "4443"); Found : user_pref("CT2269050.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...] Found : user_pref("CT2269050.backendstorage./9b?b0d:8aj62<h", "6D"); Found : user_pref("CT2269050.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B"); Found : user_pref("CT2269050.backendstorage.shoppingapp.gk.exipres", "5765642041707220323520323031322032313A[...] Found : user_pref("CT2269050.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79"); Found : user_pref("CT2269050.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...] Found : user_pref("CT2269050.globalFirstTimeInfoLastCheckTime", "Fri Apr 20 2012 21:22:23 GMT+0200"); Found : user_pref("CT2269050.homepageProtectorEnableByLogin", true); Found : user_pref("CT2269050.initDone", true); Found : user_pref("CT2269050.isAppTrackingManagerOn", true); Found : user_pref("CT2269050.isFirstRadioInstallation", false); Found : user_pref("CT2269050.myStuffEnabled", true); Found : user_pref("CT2269050.myStuffPublihserMinWidth", 400); Found : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Found : user_pref("CT2269050.myStuffServiceIntervalMM", 1440); Found : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Found : user_pref("CT2269050.navigateToUrlOnSearch", false); Found : user_pref("CT2269050.revertSettingsEnabled", true); Found : user_pref("CT2269050.searchProtectorDialogDelayInSec", 10); Found : user_pref("CT2269050.searchProtectorEnableByLogin", true); Found : user_pref("CT2269050.testingCtid", ""); Found : user_pref("CT2269050.toolbarAppMetaDataLastCheckTime", "Sun Jul 22 2012 01:10:16 GMT+0200"); Found : user_pref("CT2269050.toolbarContextMenuLastCheckTime", "Fri Apr 20 2012 21:22:25 GMT+0200"); Found : user_pref("CT2269050.usagesFlag", 2); Found : user_pref("CT2504091..clientLogIsEnabled", true); Found : user_pref("CT2504091..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Found : user_pref("CT2504091..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Found : user_pref("CT2504091.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Found : user_pref("CT2504091.CTID", "CT2504091"); Found : user_pref("CT2504091.CurrentServerDate", "24-7-2011"); Found : user_pref("CT2504091.DialogsAlignMode", "LTR"); Found : user_pref("CT2504091.DialogsGetterLastCheckTime", "Sun Jul 24 2011 01:32:16 GMT+0200"); Found : user_pref("CT2504091.DownloadReferralCookieData", ""); Found : user_pref("CT2504091.EMailNotifierPollDate", "Sun Jul 24 2011 01:32:16 GMT+0200"); Found : user_pref("CT2504091.FeedLastCount129079840422964131", 0); Found : user_pref("CT2504091.FeedPollDate128891351169457140", "Sun Jul 24 2011 01:32:16 GMT+0200"); Found : user_pref("CT2504091.FeedPollDate129079840422964131", "Sun Jul 24 2011 01:32:16 GMT+0200"); Found : user_pref("CT2504091.FeedTTL128891351169457140", 40); Found : user_pref("CT2504091.FirstServerDate", "24-7-2011"); Found : user_pref("CT2504091.FirstTime", true); Found : user_pref("CT2504091.FirstTimeFF3", true); Found : user_pref("CT2504091.FixPageNotFoundErrors", true); Found : user_pref("CT2504091.GroupingServerCheckInterval", 1440); Found : user_pref("CT2504091.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Found : user_pref("CT2504091.HasUserGlobalKeys", true); Found : user_pref("CT2504091.Initialize", true); Found : user_pref("CT2504091.InitializeCommonPrefs", true); Found : user_pref("CT2504091.InstallationAndCookieDataSentCount", 1); Found : user_pref("CT2504091.InstallationType", "UnknownIntegration"); Found : user_pref("CT2504091.InstalledDate", "Sun Jul 24 2011 01:32:16 GMT+0200"); Found : user_pref("CT2504091.IsGrouping", false); Found : user_pref("CT2504091.IsInitSetupIni", true); Found : user_pref("CT2504091.IsMulticommunity", false); Found : user_pref("CT2504091.IsOpenThankYouPage", false); Found : user_pref("CT2504091.IsOpenUninstallPage", false); Found : user_pref("CT2504091.LanguagePackLastCheckTime", "Sun Jul 24 2011 01:32:17 GMT+0200"); Found : user_pref("CT2504091.LanguagePackReloadIntervalMM", 1440); Found : user_pref("CT2504091.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Found : user_pref("CT2504091.LastLogin_3.5.0.12", "Sun Jul 24 2011 01:32:17 GMT+0200"); Found : user_pref("CT2504091.LatestVersion", "3.3.3.2"); Found : user_pref("CT2504091.Locale", "en-us"); Found : user_pref("CT2504091.MCDetectTooltipHeight", "83"); Found : user_pref("CT2504091.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Found : user_pref("CT2504091.MCDetectTooltipWidth", "295"); Found : user_pref("CT2504091.MyStuffEnabledAtInstallation", true); Found : user_pref("CT2504091.OriginalFirstVersion", "3.5.0.12"); Found : user_pref("CT2504091.SearchFromAddressBarIsInit", true); Found : user_pref("CT2504091.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT250[...] Found : user_pref("CT2504091.SearchInNewTabEnabled", true); Found : user_pref("CT2504091.SearchInNewTabIntervalMM", 1440); Found : user_pref("CT2504091.SearchInNewTabLastCheckTime", "Sun Jul 24 2011 01:32:18 GMT+0200"); Found : user_pref("CT2504091.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Found : user_pref("CT2504091.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...] Found : user_pref("CT2504091.ServiceMapLastCheckTime", "Sun Jul 24 2011 01:32:15 GMT+0200"); Found : user_pref("CT2504091.SettingsLastCheckTime", "Sun Jul 24 2011 01:32:15 GMT+0200"); Found : user_pref("CT2504091.SettingsLastUpdate", "1311168869"); Found : user_pref("CT2504091.ThirdPartyComponentsInterval", 504); Found : user_pref("CT2504091.ThirdPartyComponentsLastCheck", "Sun Jul 24 2011 01:32:15 GMT+0200"); Found : user_pref("CT2504091.ThirdPartyComponentsLastUpdate", "1246786978"); Found : user_pref("CT2504091.ToolbarShrinkedFromSetup", false); Found : user_pref("CT2504091.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2504091"); Found : user_pref("CT2504091.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Found : user_pref("CT2504091.UserID", "UN49155175105585253"); Found : user_pref("CT2504091.ValidationData_Toolbar", 0); Found : user_pref("CT2504091.alertChannelId", "897164"); Found : user_pref("CT2504091.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.[...] Found : user_pref("CT2504091.globalFirstTimeInfoLastCheckTime", "Sun Jul 24 2011 01:32:16 GMT+0200"); Found : user_pref("CT2504091.homepageProtectorEnableByLogin", true); Found : user_pref("CT2504091.initDone", true); Found : user_pref("CT2504091.isAppTrackingManagerOn", true); Found : user_pref("CT2504091.myStuffEnabled", true); Found : user_pref("CT2504091.myStuffPublihserMinWidth", 400); Found : user_pref("CT2504091.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Found : user_pref("CT2504091.myStuffServiceIntervalMM", 1440); Found : user_pref("CT2504091.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Found : user_pref("CT2504091.searchProtectorDialogDelayInSec", 10); Found : user_pref("CT2504091.searchProtectorEnableByLogin", true); Found : user_pref("CT2504091.testingCtid", ""); Found : user_pref("CT2504091.toolbarAppMetaDataLastCheckTime", "Sun Jul 24 2011 01:32:17 GMT+0200"); Found : user_pref("CT2504091.toolbarContextMenuLastCheckTime", "Sun Jul 24 2011 01:32:18 GMT+0200"); Found : user_pref("CT2504091.usagesFlag", 2); Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2269050/CT2269050[...] Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/666138/661999/DE", "\"0\"")[...] Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2269050", [...] Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2504091", [...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2269050",[...] Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2504091",[...] Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2504091/CT2504091[...] Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"229[...] Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...] Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\KillerBeas\\AppData\\Roaming\\Mozil[...] Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.12.0.8"); Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); Found : user_pref("CommunityToolbar.ToolbarsList", "CT2504091,CT2269050"); Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2504091,CT2269050"); Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2504091,CT2269050"); Found : user_pref("CommunityToolbar.globalUserId", "e16d550e-a6d5-4b89-bf43-c7ba30a019e4"); Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2269050"); Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Fri Apr 20 2012 21:22:2[...] Found : user_pref("CommunityToolbar.notifications.alertEnabled", true); Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60); Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Fri Apr 20 2012 21:22:23 GMT+020[...] Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Found : user_pref("CommunityToolbar.notifications.locale", "en"); Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Apr 20 2012 21:22:22 GMT+0200"); Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Found : user_pref("CommunityToolbar.notifications.userId", "8bd3a282-704f-46cd-9072-5acc0d7cfa94"); Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.google.de/"); Found : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...] Found : user_pref("extensions.enabledAddons", "DivXWebPlayer@divx.com:2.0.2.039,{ACAA314B-EEBA-48e4-AD47-84E[...] Profile name : default File : C:\Users\KillerBee\AppData\Roaming\Mozilla\Firefox\Profiles\7gmtiqm8.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [26143 octets] - [22/07/2012 22:01:40] ########## EOF - C:\AdwCleaner[R1].txt - [26272 octets] ########## |
|
22.07.2012, 21:13
| #8 |
| /// Helfer-Team | GVU Trojaner hat zugeschlagen Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
|
23.07.2012, 22:46
| #9 |
| | GVU Trojaner hat zugeschlagen Hey! Habe ich erledigt. Hier der Bericht! Werde jetzt den Scan machen. Danke für alles! # AdwCleaner v1.703 - Logfile created 07/23/2012 at 23:40:35 # Updated 20/07/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : KillerBeas - KILLERBEAS-PC # Running from : C:\Users\KillerBeas\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\Users\KillerBeas\AppData\Local\Conduit Folder Deleted : C:\Users\KillerBeas\AppData\LocalLow\Conduit Folder Deleted : C:\Users\KillerBeas\AppData\LocalLow\DVDVideoSoftTB Folder Deleted : C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\ConduitCommon Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Program Files (x86)\DVDVideoSoftTB ***** [Registry] ***** [*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2269050[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091 Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine Key Deleted : HKLM\SOFTWARE\Conduit Key Deleted : HKLM\SOFTWARE\DT Soft Key Deleted : HKLM\SOFTWARE\DVDVideoSoftTB Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v14.0.1 (de) Profile name : default File : C:\Users\KillerBeas\AppData\Roaming\Mozilla\Firefox\Profiles\gsd14p7q.default\prefs.js Deleted : user_pref("CT2269050..clientLogIsEnabled", false); Deleted : user_pref("CT2269050..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Deleted : user_pref("CT2269050..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Deleted : user_pref("CT2269050.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Deleted : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Deleted : user_pref("CT2269050.BrowserCompStateIsOpen_129681780741097243", true); Deleted : user_pref("CT2269050.BrowserCompStateIsOpen_129853623028165512", true); Deleted : user_pref("CT2269050.CTID", "CT2269050"); Deleted : user_pref("CT2269050.CurrentServerDate", "22-7-2012"); Deleted : user_pref("CT2269050.DSInstall", false); Deleted : user_pref("CT2269050.DialogsAlignMode", "LTR"); Deleted : user_pref("CT2269050.DialogsGetterLastCheckTime", "Thu Jul 19 2012 22:45:57 GMT+0200"); Deleted : user_pref("CT2269050.DownloadReferralCookieData", ""); Deleted : user_pref("CT2269050.EMailNotifierPollDate", "Fri Apr 20 2012 21:22:22 GMT+0200"); Deleted : user_pref("CT2269050.FirstServerDate", "20-4-2012"); Deleted : user_pref("CT2269050.FirstTime", true); Deleted : user_pref("CT2269050.FirstTimeFF3", true); Deleted : user_pref("CT2269050.FixPageNotFoundErrors", true); Deleted : user_pref("CT2269050.GroupingServerCheckInterval", 1440); Deleted : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Deleted : user_pref("CT2269050.HPInstall", false); Deleted : user_pref("CT2269050.HasUserGlobalKeys", true); Deleted : user_pref("CT2269050.Initialize", true); Deleted : user_pref("CT2269050.InitializeCommonPrefs", true); Deleted : user_pref("CT2269050.InstallationAndCookieDataSentCount", 3); Deleted : user_pref("CT2269050.InstallationType", "UnknownIntegration"); Deleted : user_pref("CT2269050.InstalledDate", "Fri Apr 20 2012 21:22:22 GMT+0200"); Deleted : user_pref("CT2269050.InvalidateCache", false); Deleted : user_pref("CT2269050.IsGrouping", false); Deleted : user_pref("CT2269050.IsInitSetupIni", true); Deleted : user_pref("CT2269050.IsMulticommunity", false); Deleted : user_pref("CT2269050.IsOpenThankYouPage", false); Deleted : user_pref("CT2269050.IsOpenUninstallPage", false); Deleted : user_pref("CT2269050.LanguagePackLastCheckTime", "Sun Jul 22 2012 01:10:27 GMT+0200"); Deleted : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440); Deleted : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Deleted : user_pref("CT2269050.LastLogin_3.12.0.8", "Thu Apr 26 2012 00:01:22 GMT+0200"); Deleted : user_pref("CT2269050.LastLogin_3.12.2.3", "Wed May 30 2012 11:18:32 GMT+0200"); Deleted : user_pref("CT2269050.LastLogin_3.13.0.6", "Thu Jun 28 2012 16:15:06 GMT+0200"); Deleted : user_pref("CT2269050.LastLogin_3.14.1.0", "Sun Jul 22 2012 01:03:58 GMT+0200"); Deleted : user_pref("CT2269050.LatestVersion", "3.13.0.6"); Deleted : user_pref("CT2269050.Locale", "en"); Deleted : user_pref("CT2269050.MCDetectTooltipHeight", "83"); Deleted : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Deleted : user_pref("CT2269050.MCDetectTooltipWidth", "295"); Deleted : user_pref("CT2269050.MyStuffEnabledAtInstallation", true); Deleted : user_pref("CT2269050.OriginalFirstVersion", "3.12.0.8"); Deleted : user_pref("CT2269050.RadioIsPodcast", false); Deleted : user_pref("CT2269050.RadioLastCheckTime", "Fri Apr 20 2012 21:22:23 GMT+0200"); Deleted : user_pref("CT2269050.RadioLastUpdateIPServer", "3"); Deleted : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000"); Deleted : user_pref("CT2269050.RadioMediaID", "12473383"); Deleted : user_pref("CT2269050.RadioMediaType", "Media Player"); Deleted : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383"); Deleted : user_pref("CT2269050.RadioShrinkedFromSetup", false); Deleted : user_pref("CT2269050.RadioStationName", "Hotmix%20108"); Deleted : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082"); Deleted : user_pref("CT2269050.SearchCaption", "DVDVideoSoftTB Customized Web Search"); Deleted : user_pref("CT2269050.SearchFromAddressBarIsInit", true); Deleted : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...] Deleted : user_pref("CT2269050.SearchInNewTabEnabled", true); Deleted : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440); Deleted : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Sun Jul 22 2012 01:10:11 GMT+0200"); Deleted : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Deleted : user_pref("CT2269050.SendProtectorDataViaLogin", true); Deleted : user_pref("CT2269050.ServiceMapLastCheckTime", "Sun Jul 22 2012 01:10:16 GMT+0200"); Deleted : user_pref("CT2269050.SettingsLastCheckTime", "Sun Jul 22 2012 01:03:02 GMT+0200"); Deleted : user_pref("CT2269050.SettingsLastUpdate", "1341904940"); Deleted : user_pref("CT2269050.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13"); Deleted : user_pref("CT2269050.ThirdPartyComponentsInterval", 504); Deleted : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Fri Apr 20 2012 21:22:18 GMT+0200"); Deleted : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1312887586"); Deleted : user_pref("CT2269050.ToolbarShrinkedFromSetup", false); Deleted : user_pref("CT2269050.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2269050"); Deleted : user_pref("CT2269050.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Deleted : user_pref("CT2269050.UserID", "UN14047572394191617"); Deleted : user_pref("CT2269050.WeatherNetwork", ""); Deleted : user_pref("CT2269050.WeatherPollDate", "Fri Apr 20 2012 21:22:25 GMT+0200"); Deleted : user_pref("CT2269050.WeatherUnit", "C"); Deleted : user_pref("CT2269050.alertChannelId", "666138"); Deleted : user_pref("CT2269050.autoDisableScopes", -1); Deleted : user_pref("CT2269050.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e06cg5el8:", "6E6D6E6E6A706C6F7378"); Deleted : user_pref("CT2269050.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A7473747470767275797E242F4B4947[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...] Deleted : user_pref("CT2269050.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...] Deleted : user_pref("CT2269050.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...] Deleted : user_pref("CT2269050.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...] Deleted : user_pref("CT2269050.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...] Deleted : user_pref("CT2269050.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...] Deleted : user_pref("CT2269050.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...] Deleted : user_pref("CT2269050.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...] Deleted : user_pref("CT2269050.backendstorage./9b-0?3g>d", "6D70716D6D3F41457A45434773207D797777257D5220202A23[...] Deleted : user_pref("CT2269050.backendstorage./9b-0?3g@6:5;", ""); Deleted : user_pref("CT2269050.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F297B7E7D21202F26313E424[...] Deleted : user_pref("CT2269050.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576"); Deleted : user_pref("CT2269050.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484776213F3E484F4E4D464[...] Deleted : user_pref("CT2269050.backendstorage./9b5ba==9cjag", "6E3C6B706A6E71407A78794573794A4C4D7E7C4F22"); Deleted : user_pref("CT2269050.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6E6E6A706C6F7370727479"); Deleted : user_pref("CT2269050.backendstorage./9b9643g3/9e", "6A"); Deleted : user_pref("CT2269050.backendstorage./9b<:222h64<", "393F352F3E"); Deleted : user_pref("CT2269050.backendstorage./9b=+03eh8h8j?:", "4443"); Deleted : user_pref("CT2269050.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...] Deleted : user_pref("CT2269050.backendstorage./9b?b0d:8aj62<h", "6D"); Deleted : user_pref("CT2269050.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B"); Deleted : user_pref("CT2269050.backendstorage.shoppingapp.gk.exipres", "5765642041707220323520323031322032313A[...] Deleted : user_pref("CT2269050.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79"); Deleted : user_pref("CT2269050.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...] Deleted : user_pref("CT2269050.globalFirstTimeInfoLastCheckTime", "Fri Apr 20 2012 21:22:23 GMT+0200"); Deleted : user_pref("CT2269050.homepageProtectorEnableByLogin", true); Deleted : user_pref("CT2269050.initDone", true); Deleted : user_pref("CT2269050.isAppTrackingManagerOn", true); Deleted : user_pref("CT2269050.isFirstRadioInstallation", false); Deleted : user_pref("CT2269050.myStuffEnabled", true); Deleted : user_pref("CT2269050.myStuffPublihserMinWidth", 400); Deleted : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Deleted : user_pref("CT2269050.myStuffServiceIntervalMM", 1440); Deleted : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Deleted : user_pref("CT2269050.navigateToUrlOnSearch", false); Deleted : user_pref("CT2269050.revertSettingsEnabled", true); Deleted : user_pref("CT2269050.searchProtectorDialogDelayInSec", 10); Deleted : user_pref("CT2269050.searchProtectorEnableByLogin", true); Deleted : user_pref("CT2269050.testingCtid", ""); Deleted : user_pref("CT2269050.toolbarAppMetaDataLastCheckTime", "Sun Jul 22 2012 01:10:16 GMT+0200"); Deleted : user_pref("CT2269050.toolbarContextMenuLastCheckTime", "Fri Apr 20 2012 21:22:25 GMT+0200"); Deleted : user_pref("CT2269050.usagesFlag", 2); Deleted : user_pref("CT2504091..clientLogIsEnabled", true); Deleted : user_pref("CT2504091..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Deleted : user_pref("CT2504091..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Deleted : user_pref("CT2504091.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Deleted : user_pref("CT2504091.CTID", "CT2504091"); Deleted : user_pref("CT2504091.CurrentServerDate", "24-7-2011"); Deleted : user_pref("CT2504091.DialogsAlignMode", "LTR"); Deleted : user_pref("CT2504091.DialogsGetterLastCheckTime", "Sun Jul 24 2011 01:32:16 GMT+0200"); Deleted : user_pref("CT2504091.DownloadReferralCookieData", ""); Deleted : user_pref("CT2504091.EMailNotifierPollDate", "Sun Jul 24 2011 01:32:16 GMT+0200"); Deleted : user_pref("CT2504091.FeedLastCount129079840422964131", 0); Deleted : user_pref("CT2504091.FeedPollDate128891351169457140", "Sun Jul 24 2011 01:32:16 GMT+0200"); Deleted : user_pref("CT2504091.FeedPollDate129079840422964131", "Sun Jul 24 2011 01:32:16 GMT+0200"); Deleted : user_pref("CT2504091.FeedTTL128891351169457140", 40); Deleted : user_pref("CT2504091.FirstServerDate", "24-7-2011"); Deleted : user_pref("CT2504091.FirstTime", true); Deleted : user_pref("CT2504091.FirstTimeFF3", true); Deleted : user_pref("CT2504091.FixPageNotFoundErrors", true); Deleted : user_pref("CT2504091.GroupingServerCheckInterval", 1440); Deleted : user_pref("CT2504091.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Deleted : user_pref("CT2504091.HasUserGlobalKeys", true); Deleted : user_pref("CT2504091.Initialize", true); Deleted : user_pref("CT2504091.InitializeCommonPrefs", true); Deleted : user_pref("CT2504091.InstallationAndCookieDataSentCount", 1); Deleted : user_pref("CT2504091.InstallationType", "UnknownIntegration"); Deleted : user_pref("CT2504091.InstalledDate", "Sun Jul 24 2011 01:32:16 GMT+0200"); Deleted : user_pref("CT2504091.IsGrouping", false); Deleted : user_pref("CT2504091.IsInitSetupIni", true); Deleted : user_pref("CT2504091.IsMulticommunity", false); Deleted : user_pref("CT2504091.IsOpenThankYouPage", false); Deleted : user_pref("CT2504091.IsOpenUninstallPage", false); Deleted : user_pref("CT2504091.LanguagePackLastCheckTime", "Sun Jul 24 2011 01:32:17 GMT+0200"); Deleted : user_pref("CT2504091.LanguagePackReloadIntervalMM", 1440); Deleted : user_pref("CT2504091.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Deleted : user_pref("CT2504091.LastLogin_3.5.0.12", "Sun Jul 24 2011 01:32:17 GMT+0200"); Deleted : user_pref("CT2504091.LatestVersion", "3.3.3.2"); Deleted : user_pref("CT2504091.Locale", "en-us"); Deleted : user_pref("CT2504091.MCDetectTooltipHeight", "83"); Deleted : user_pref("CT2504091.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Deleted : user_pref("CT2504091.MCDetectTooltipWidth", "295"); Deleted : user_pref("CT2504091.MyStuffEnabledAtInstallation", true); Deleted : user_pref("CT2504091.OriginalFirstVersion", "3.5.0.12"); Deleted : user_pref("CT2504091.SearchFromAddressBarIsInit", true); Deleted : user_pref("CT2504091.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT250[...] Deleted : user_pref("CT2504091.SearchInNewTabEnabled", true); Deleted : user_pref("CT2504091.SearchInNewTabIntervalMM", 1440); Deleted : user_pref("CT2504091.SearchInNewTabLastCheckTime", "Sun Jul 24 2011 01:32:18 GMT+0200"); Deleted : user_pref("CT2504091.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Deleted : user_pref("CT2504091.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...] Deleted : user_pref("CT2504091.ServiceMapLastCheckTime", "Sun Jul 24 2011 01:32:15 GMT+0200"); Deleted : user_pref("CT2504091.SettingsLastCheckTime", "Sun Jul 24 2011 01:32:15 GMT+0200"); Deleted : user_pref("CT2504091.SettingsLastUpdate", "1311168869"); Deleted : user_pref("CT2504091.ThirdPartyComponentsInterval", 504); Deleted : user_pref("CT2504091.ThirdPartyComponentsLastCheck", "Sun Jul 24 2011 01:32:15 GMT+0200"); Deleted : user_pref("CT2504091.ThirdPartyComponentsLastUpdate", "1246786978"); Deleted : user_pref("CT2504091.ToolbarShrinkedFromSetup", false); Deleted : user_pref("CT2504091.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2504091"); Deleted : user_pref("CT2504091.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Deleted : user_pref("CT2504091.UserID", "UN49155175105585253"); Deleted : user_pref("CT2504091.ValidationData_Toolbar", 0); Deleted : user_pref("CT2504091.alertChannelId", "897164"); Deleted : user_pref("CT2504091.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.[...] Deleted : user_pref("CT2504091.globalFirstTimeInfoLastCheckTime", "Sun Jul 24 2011 01:32:16 GMT+0200"); Deleted : user_pref("CT2504091.homepageProtectorEnableByLogin", true); Deleted : user_pref("CT2504091.initDone", true); Deleted : user_pref("CT2504091.isAppTrackingManagerOn", true); Deleted : user_pref("CT2504091.myStuffEnabled", true); Deleted : user_pref("CT2504091.myStuffPublihserMinWidth", 400); Deleted : user_pref("CT2504091.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Deleted : user_pref("CT2504091.myStuffServiceIntervalMM", 1440); Deleted : user_pref("CT2504091.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Deleted : user_pref("CT2504091.searchProtectorDialogDelayInSec", 10); Deleted : user_pref("CT2504091.searchProtectorEnableByLogin", true); Deleted : user_pref("CT2504091.testingCtid", ""); Deleted : user_pref("CT2504091.toolbarAppMetaDataLastCheckTime", "Sun Jul 24 2011 01:32:17 GMT+0200"); Deleted : user_pref("CT2504091.toolbarContextMenuLastCheckTime", "Sun Jul 24 2011 01:32:18 GMT+0200"); Deleted : user_pref("CT2504091.usagesFlag", 2); Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2269050/CT2269050[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/666138/661999/DE", "\"0\"")[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2269050", [...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2504091", [...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2269050",[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2504091",[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2504091/CT2504091[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"229[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...] Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\KillerBeas\\AppData\\Roaming\\Mozil[...] Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.12.0.8"); Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2504091,CT2269050"); Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2504091,CT2269050"); Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2504091,CT2269050"); Deleted : user_pref("CommunityToolbar.globalUserId", "e16d550e-a6d5-4b89-bf43-c7ba30a019e4"); Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2269050"); Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Fri Apr 20 2012 21:22:2[...] Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", true); Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60); Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Fri Apr 20 2012 21:22:23 GMT+020[...] Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.locale", "en"); Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Apr 20 2012 21:22:22 GMT+0200"); Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Deleted : user_pref("CommunityToolbar.notifications.userId", "8bd3a282-704f-46cd-9072-5acc0d7cfa94"); Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.google.de/"); Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...] Deleted : user_pref("extensions.enabledAddons", "DivXWebPlayer@divx.com:2.0.2.039,{ACAA314B-EEBA-48e4-AD47-84E[...] Profile name : default File : C:\Users\KillerBee\AppData\Roaming\Mozilla\Firefox\Profiles\7gmtiqm8.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [26258 octets] - [22/07/2012 22:01:40] AdwCleaner[S1].txt - [283 octets] - [23/07/2012 23:40:13] AdwCleaner[R2].txt - [26378 octets] - [23/07/2012 23:40:23] AdwCleaner[S2].txt - [26353 octets] - [23/07/2012 23:40:35] ########## EOF - C:\AdwCleaner[S2].txt - [26482 octets] ########## |
|
24.07.2012, 00:39
| #10 |
| /// Helfer-Team | GVU Trojaner hat zugeschlagen Emsisoft Logfile? |
|
24.07.2012, 12:22
| #11 |
| | GVU Trojaner hat zugeschlagen Hier der Bericht: Emsisoft Anti-Malware - Version 6.6 Letztes Update: 24.07.2012 01:59:31 Scan Einstellungen: Scan Methode: Detail Scan Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\, F:\, G:\ Archiv Scan: An ADS Scan: An Scan Beginn: 24.07.2012 11:07:47 Key: hkey_local_machine\software\trymedia systems gefunden: Trace.Registry.trymedia!E1 Key: hkey_local_machine\software\trymedia systems\activemark software gefunden: Trace.Registry.trymedia!E1 Gescannt 809812 Gefunden 2 Scan Ende: 24.07.2012 13:14:04 Scan Zeit: 2:06:17 Key: hkey_local_machine\software\trymedia systems Quarantäne Trace.Registry.trymedia!E1 Key: hkey_local_machine\software\trymedia systems\activemark software Quarantäne Trace.Registry.trymedia!E1 Quarantäne 2 |
|
24.07.2012, 23:53
| #12 |
| /// Helfer-Team | GVU Trojaner hat zugeschlagen Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
25.07.2012, 22:14
| #13 |
| | GVU Trojaner hat zugeschlagen Hier der Bericht! Sorry das immer so viel Zeit dazwischen liegt! ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=09cee2ef91452b43ad13a8cc16c1d03d # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-07-25 06:44:10 # local_time=2012-07-25 08:44:10 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=4096 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776573 100 94 508 94852960 0 0 # compatibility_mode=8192 67108863 100 0 104 104 0 0 # scanned=398465 # found=0 # cleaned=0 # scan_time=18740 ESETSmartInstaller@High as downloader log: Can not open internetESETSmartInstaller@High as downloader log: Can not open internet# version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=09cee2ef91452b43ad13a8cc16c1d03d # end=stopped # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-07-25 09:11:44 # local_time=2012-07-25 11:11:44 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=4096 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776573 100 94 5478 94880549 0 0 # compatibility_mode=8192 67108863 100 0 27693 27693 0 0 # scanned=110 # found=0 # cleaned=0 # scan_time=5 |
|
26.07.2012, 11:27
| #14 |
| /// Helfer-Team | GVU Trojaner hat zugeschlagen Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html |
|
26.07.2012, 14:05
| #15 |
| | GVU Trojaner hat zugeschlagen Hey! Auch erledigt!  Was folg jetzt?Grüße |
|
| Themen zu GVU Trojaner hat zugeschlagen |
| adobe, antivirus, bankguard, bho, bonjour, conduit, ctfmon.lnk, desktop, excel, explorer, firefox, format, gesperrt, google earth, hacktool.gamescheat, helper, helper.exe, heuristiks/extra, heuristiks/shuriken, home, internet, langs, launch, logfile, mozilla, netzwerk, object, plug-in, realtek, registry, safer networking, searchscopes, security, software, temp, trojaner, windows, windows 7 64 bit |
Linear-Darstellung
